mirror of
https://github.com/torvalds/linux.git
synced 2026-10-07 22:37:45 -04:00
Eric Biggers
3619dec510
Commit383203eff7("dh key: get rid of stack allocated array") changed kdf_ctr() to assume that the length of key material to derive is a multiple of the digest size. The length was supposed to be rounded up accordingly. However, the round_up() macro was used which only gives the correct result on power-of-2 arguments, whereas not all hash algorithms have power-of-2 digest sizes. In some cases this resulted in a write past the end of the 'outbuf' buffer. Fix it by switching to roundup(), which works for non-power-of-2 inputs. Reported-by: [email protected] Reported-by: [email protected] Reported-by: [email protected] Reported-by: [email protected] Fixes:383203eff7("dh key: get rid of stack allocated array") Signed-off-by: Eric Biggers <[email protected]> Acked-by: Kees Cook <[email protected]> Acked-by: Tycho Andersen <[email protected]> Signed-off-by: James Morris <[email protected]>